name: Build and Release RaveOS ISO

on:
  push:
    branches: ["main"]
  workflow_dispatch:

jobs:
  build-iso:
    runs-on: iso-builder

    env:
      TMPDIR: ${{ github.workspace }}/.tmp
      GIT_TMPDIR: ${{ github.workspace }}/.tmp

    steps:
      - name: Checkout build repository
        uses: actions/checkout@v4

      - name: Prepare temp directories (NO /tmp usage)
        run: |
          set -euo pipefail
          mkdir -p "${GITHUB_WORKSPACE}/.tmp"
          df -h

      - name: Fix raveos-core-repo pacman repo (overwrite clean)
        run: |
          set -euo pipefail
          sudo sed -i '/^\[raveos-core-repo\]/,/^$/d' /etc/pacman.conf
          cat <<'EOF' | sudo tee -a /etc/pacman.conf
          [raveos-core-repo]
          SigLevel = Never TrustAll
          Server = https://page.rp1.hu/x86_64/
          EOF

      - name: Sync and update runner
        run: |
          set -euo pipefail
          sudo pacman -Sy --noconfirm
          if pacman -Qu 2>/dev/null | grep -q .; then
            echo "Elavult csomagok talalhatok, auto-frissites indul..."
            sudo pacman -Su --noconfirm
            echo "Runner auto-frissites: OK"
          else
            echo "Runner konzisztencia ellenorzes: OK"
          fi

      - name: Verify archiso
        run: pacman -Q archiso

      - name: Setup Chaotic-AUR
        run: |
          set -euo pipefail
          if [ ! -f /etc/pacman.d/chaotic-mirrorlist ]; then
            sudo mkdir -p /etc/pacman.d
            echo 'Server = https://cdn-mirror.chaotic.cx/$repo/$arch' | sudo tee /etc/pacman.d/chaotic-mirrorlist
            sudo pacman-key --recv-key 3056513887B78AEB --keyserver keyserver.ubuntu.com || true
            sudo pacman-key --lsign-key 3056513887B78AEB || true
            sudo pacman -U --noconfirm \
              https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst \
              https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst || true
          fi

      - name: Setup RaveOS signing key
        run: |
          set -euo pipefail
          cat <<'RAVEOSKEY' | sudo pacman-key --add -
          -----BEGIN PGP PUBLIC KEY BLOCK-----

          mQINBGpKEcwBEADO1pmU6fnh8kIJyotgKkf5MWHNyQNL7ESiuPWuAdBdtnSXLY/N
          k7lyqc0ilAPzq1n+98Uvrh2DEgztARGW780gUP1RiCPOOmXGM9y9MGRgHg8KizI9
          17ZbOREYKpJ5cJI8Xs81YzPod7SXHxh+lF3rkY5F0BQS5nu1h0szxE8b75FaoKqw
          fJeFH3Bi51twZEghsl4c5tKjqJ0Kz3F5ikWTJTdQB63ui9quSKLxRbzFrUB0GQeU
          yvXzW8Ag0PsCFSXrFC+OXBmNEvnUB4qsR2QNfa3zjyDMIJPAVXrBbkgblXbs0GMf
          15uBcJUjI1KmyObakRuBpK0GuHR48lPEahsuy5vab0rO8NepYaaxsxHGLJQNhv1i
          53ZKlVjkMjBdfL5Qrr4YpD5VXpoIL4mcfFZCjqdWpuNpJ2UxbhJrHwgDZkgm/znE
          lSAJYX4FbEW98igNE7tazEPL4s04J9JzMik2sB3fKU+Q3r5lkkiDUNEp2Ibzwjra
          2ZWyYx/3Sckz9Dmp0ftdo4dzBZcXlKg8z5+b0I7pO9/l3Wl36b/YdifAzpazeG0o
          l/4IhVS5CZKEcftpPw8iaN33Y2YonncHESZZsKKbh5ag4KP81poa6/TbYdeoSnpi
          5uZfVDKht/lRMIogofdl6jmuP7pazvHza6utVF8WP8bpcCEJWqHTUfJC9wARAQAB
          tD5SYXZlT1MgQnVpbGQgKFJhdmVPUyBwYWNrYWdlIHNpZ25pbmcga2V5KSA8YnVp
          bGRAcmF2ZW9zLmxvY2FsPokCVQQTAQoAPxYhBCXHZo8SNfVmTwN2cb2yqc5uv/ET
          BQJqShHMAxsvBAUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRC9sqnO
          br/xE1L1D/92YNrMnjZJiHF73WewEtHcUcTA2//HvMWav1euF3Pr1JKxg7Ectvx1
          G1JyBgHfrL7HVayJi6JNDZ4QMq4U9M+L4rEFzxXwu2J5Y8L260smG5mWIhT4HQuX
          POrm0LAoDa5DAZjotNA+irkNEap1pbhSUsCHZY0gHavf3rTM1EsiikBfHgRySfJw
          G8gsxk5CmMkCDP+fdCHulexG08j08cOSKkyfzsV5ipzgvoMAtcS7fzZt6dkdIw2r
          glAoJojUeKScEYclmQ7uOnaqnlSzeafiqVV+D+1QkotkyTY4S6Y9LnAcy7RjtN+H
          HhbjadQEcSl71MZbNuhYeexyW1/UWpEO96ri06dZT9+FNxU+IU8wKI9jwPNUyWEU
          Dce5rrnYeKkfYiYyX8L6SNuWEPMMC/JodUaSSm538m7aOVBg4e5vFZo71LvvPz2s
          W0TJhXgdKA9cCpjVmIowYxi3tVItVIeusvSCKGxgJHq90JJTQlmss2zWjOPAbOEt
          kHpCPYPPHzcl4ymITRBLgxV5+wS9Gy6vbaL7xA5cItq1z5PeHq+Ig4GZfEqMfIAp
          gslSlmWzNU+Mx89EM4mDtF2UWoNsovEYKaI6rc8O+V+anBkQSQqGqmaC1X8tcp1H
          jpCccjbzX+ggBg9zVTNDU5VsRP9iy2bae7uTvpQERIi99wkuUBot+bkCDQRqShHM
          ARAA55Wyl4l0bldkdMVnpqWuMxGg99R3tEtUfaCbAZETCxYwVP1UF7Zi+82cShOj
          sZxqUL+ET6/ENn9giJCj7FKia0ghsQGnFKwnPk1i1b4IkQDColLCD8cPk1hocc5R
          N9fqrwXEr01l3pegfF2FlpqgAXkypXjeIdv/PcNHxxOujVblj0rdZzFX9py3nOyE
          iz+QqIFWu5XYMgkQCZLoA/W546xU5g2R5IOVM2WTpyhK+J0LiM4gLO8CCEm1BcHQ
          uVYBHGRwootAqcAWQELY1UMG7uDBd/XUDvBfk6s4c02rqZYYDLq29kiGdtpImnB8
          PDQyrON4J2FrbuENBo/HkGpciNq0mqiGZwbamNqKqrInNCR/vqvSM2l2BOj29H+S
          R9VbQJ1FVngIHEVq1mRnjz+ML6ENHKHWezel/8EEGbbx4fVu2b+Qs2YF3PbKQfNa
          wNJIAyzeAGr/6hA8cDYFy/AuK1VuAGoepiW/MykqdoFD27kL8BSXEfH2oSI4WVbb
          FW52hgM7QrlJC1ijDuOSM3MAuy5GrtMvvuxy0SjyCwpWOOXAq+xwQ14HS+AJDkln
          J8fsI8O6dvrVgE8wQVJUT4xmjOkPHB8G7kQmGO9yno+1qxyAZBCwXcCcP3yZ9htm
          QCpIyV8vFfOX9HBlwDRkJs1S6Y7ujvN7EyZePRyj6GjBWAkAEQEAAYkEcgQYAQoA
          JhYhBCXHZo8SNfVmTwN2cb2yqc5uv/ETBQJqShHMAhsuBQkDwmcAAkAJEL2yqc5u
          v/ETwXQgBBkBCgAdFiEEamEu3lkBHnuTx4HbL1bjKGFDmLYFAmpKEcwACgkQL1bj
          KGFDmLaJHA//SaC7qa9wKx7uJaR6Jc5agXJA4JvJluxN89PrDqBPAWyyrVOnqMJm
          PlHDdzkOJPICf0hpR1rvBs0tohZ7FKKeif8OxY0iwXUgRAUtreeXzQZCwtvaEaUc
          HjWTM8WYlYzCNXsuBwn4p4XW/CmrdGBjeW6aDTozXqrvsEWUlAVRxZOXSY1j0Rex
          5hDI+cEXCorm6VT7y5ExlzC6KRve6ZV1TAPhbZPRsH3cP83L6ROXqdQXd2Jea+Pf
          W4FSaOlFpI0RraOqnZQdqwD5jTm8B06ABec9sqntBz7ARVltXqdcAevZm++XauNH
          8kQc7nx98BoWR685CSsxH3vOdTOl/O6SiYJSUNHXKqCUrKJt4y1ewC6DgE12OYa3
          M7o1U/0Q8uHYnpt+9d5exBAIVcvruvxdWWOXKE44v8oTUAfKcrsa3PhQZ217EJmw
          scKwQqM4ng51LSGoK/fEeMnU7YB33M254zKF9K90P97w+88KCljKrXDzcNIEFxZL
          UFw9WVjYxz0iAhmof1l5C67cMZ49s2DoVWlQWa5jRLKPM9iGZYWg00IIqPUydvsR
          l5wPi6YtxAXHELy+MhBov78mzu7zmOwuYCpY+vhg+/uyz3+8qESuBTxP+vwreIum
          8PaUp+bRBdcS9q7jB203/lcZHKrIsHkWyf8TyRrJUMnylOtecreRgRQxwBAAzrHN
          bgeCzHiFu7eLHJmRGS1pwKPwYnRmeqjIcveJYSF7Tpm8N1m5jpOa+ppG4YtvFuFb
          y/Wu+G6ILdVGqWNt8NETk9AIW3qdM+fUrQlgiWUe1yCXCgJn7HClbrPAphsLokRs
          WdaRPFG1rOBDI4gHGZ5wNRaUCAVfJh6W3aBUEUE0VNKb9UA5tY4uDokpVeXl6aTA
          cN4DDediZtgEQZssg5C31qGldNtAYLQI0TwFXfWltNLmecgvvyE0USEqV+a0mvrB
          mLHngIUZ+v9Ba00jAUHvfKZB/vlcH7xKcI8wig4W2jSNROHqzgCx5TuzXaj1WTnB
          9K0eTlRjD51P03Iz6jTmdZk0pQmyhUZ9KNztePcWn8s+5plA0U5cAAHCK+J4LsPl
          EVsMFA8cTXpLX3L/uoc+LsIl8z0Q1y0DyJYLqZwRnaZi9nabyr7AiO8GTQiIjqjx
          eJX+IWiAvl0krp/Eul/6yovVv1YSNphI5VI4luoYzWh3PgGv3DwtC4My3bVjkJUi
          Y4Zg2ddmRpAEHb7h94vB0XEKrzAUQk01MNgGL3iUFXmAwo/C0CdIN27KMiupVlj/
          quNVMkWW0wFR8RBwnGZiVdU+h2n3QuHPVOFrkYoy/SbS49+TAH4tzH5nrM85JmRj
          ibVZLr5g97pSMBQUv/dO6I+jfPtqITpDupTdDgg=
          =WGkj
          -----END PGP PUBLIC KEY BLOCK-----
          RAVEOSKEY
          sudo pacman-key --lsign-key 25C7668F1235F5664F037671BDB2A9CE6EBFF113

      - name: Build ISO
        run: |
          set -euo pipefail
          chmod +x ./build.sh
          sudo ./build.sh

      - name: Check build output
        run: |
          set -euo pipefail
          ls -lh output/*.iso

      - name: Check ISO for broken library links
        run: |
          set -euo pipefail
          sudo modprobe loop || true
          ISO_FILE=$(ls output/*.iso | head -1)
          MOUNT_DIR=$(mktemp -d)

          if ! sudo mount -o loop,ro "$ISO_FILE" "$MOUNT_DIR" 2>/dev/null; then
            echo "FIGYELMEZETES: ISO mountolas sikertelen (loop eszkoz nem elerheto), ldd ellenorzes kihagyva"
            rmdir "$MOUNT_DIR"
            exit 0
          fi

          BROKEN=0
          while IFS= read -r bin; do
            result=$(sudo chroot "$MOUNT_DIR" ldd "${bin#$MOUNT_DIR}" 2>/dev/null | grep "not found" || true)
            if [ -n "$result" ]; then
              echo "TOROTT: $bin"
              echo "$result"
              BROKEN=1
            fi
          done < <(find "$MOUNT_DIR" -type f \( -name "*.so*" -o -perm /111 \) 2>/dev/null | xargs -r file 2>/dev/null | grep ELF | cut -d: -f1)

          sudo umount "$MOUNT_DIR"
          rmdir "$MOUNT_DIR"

          if [ "$BROKEN" -eq 1 ]; then
            echo "HIBA: Torott library linkek az ISO-ban. Build leallitva."
            exit 1
          fi
          echo "ISO library ellenorzes: OK"

      - name: Upload ISO to release server
        run: |
          set -euo pipefail
          ISO_FILE=$(ls output/*.iso | head -1)
          ISO_NAME=$(basename "$ISO_FILE")

          mkdir -p ~/.ssh
          echo "${{ secrets.VPS_RELEASE_KEY }}" > ~/.ssh/vps_release_key
          chmod 600 ~/.ssh/vps_release_key

          # Új ISO feltöltése
          scp -i ~/.ssh/vps_release_key -P ${{ secrets.VPS_PORT }} -o StrictHostKeyChecking=no \
            "$ISO_FILE" "${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }}:${{ secrets.VPS_RELEASES_PATH }}/${ISO_NAME}"

          # 3-nál régebbi ISO-k törlése a VPS-ről
          ssh -i ~/.ssh/vps_release_key -p ${{ secrets.VPS_PORT }} -o StrictHostKeyChecking=no \
            ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }} "ls -t ${{ secrets.VPS_RELEASES_PATH }}/*.iso 2>/dev/null | tail -n +4 | xargs -r rm -f"

          echo "ISO feltoltve: https://release.rp1.hu/${ISO_NAME}"
          echo "ISO_NAME=${ISO_NAME}" >> "$GITHUB_ENV"

      - name: Create Forgejo Release with external link
        run: |
          set -euo pipefail

          ISO_FILE=$(ls output/*.iso | head -1)
          ISO_NAME=$(basename "$ISO_FILE")
          ISO_SIZE=$(du -h "$ISO_FILE" | cut -f1)
          ISO_SHA256=$(sha256sum "$ISO_FILE" | cut -d' ' -f1)
          BUILD_DATE=$(date '+%Y-%m-%d %H:%M:%S')
          COMMIT_SHORT=${GITHUB_SHA::7}
          TAG="v$(date '+%Y.%m.%d')-${COMMIT_SHORT}"

          RELEASE_BODY="Build Date: ${BUILD_DATE}
          Filename: ${ISO_NAME}
          Size: ${ISO_SIZE}
          SHA256: ${ISO_SHA256}
          Source Commit: ${COMMIT_SHORT}

          Verification:
          echo \"${ISO_SHA256}  ${ISO_NAME}\" | sha256sum -c"

          RELEASE=$(curl -f -s --retry 3 --retry-delay 5 \
            -X POST "https://git.rp1.hu/api/v1/repos/RaveOS/RaveOS-Releases/releases" \
            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"${TAG}\",\"name\":\"RaveOS ${TAG}\",\"body\":$(echo "$RELEASE_BODY" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))'),\"draft\":false,\"prerelease\":false}")

          RELEASE_ID=$(echo "$RELEASE" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
          [[ "$RELEASE_ID" =~ ^[0-9]+$ ]] || { echo "HIBA: Ervenytelen RELEASE_ID: $RELEASE_ID"; exit 1; }
          echo "Release ID: $RELEASE_ID"

          # External link hozzáadása attachment helyett
          curl -f -s --retry 3 \
            -X POST "https://git.rp1.hu/api/v1/repos/RaveOS/RaveOS-Releases/releases/${RELEASE_ID}/assets?external_url=https://release.rp1.hu/${ISO_NAME}" \
            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
            -F "name=${ISO_NAME}"
          echo "External link hozzaadva: https://release.rp1.hu/${ISO_NAME}"

          echo "Release kesz: https://git.rp1.hu/RaveOS/RaveOS-Releases/releases/tag/${TAG}"

          # Regi release-ek torlese (3-nal tobbet nem tartunk)
          RELEASES=$(curl -f -s --retry 3 --retry-delay 5 \
            "https://git.rp1.hu/api/v1/repos/RaveOS/RaveOS-Releases/releases?limit=50" \
            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}")

          echo "$RELEASES" | python3 -c "import sys,json; releases=json.load(sys.stdin); releases.sort(key=lambda r:r['id'],reverse=True); [print(r['id'],r['tag_name']) for r in releases[3:]]" | while IFS=' ' read -r id tag; do
            curl -f -s --retry 3 -X DELETE "https://git.rp1.hu/api/v1/repos/RaveOS/RaveOS-Releases/releases/$id" \
              -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}"
            curl -f -s --retry 3 -X DELETE "https://git.rp1.hu/api/v1/repos/RaveOS/RaveOS-Releases/tags/$tag" \
              -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}"
            echo "Regi release torolve: $tag"
          done

      - name: Cleanup (SAFE)
        if: always()
        run: |
          rm -f ~/.ssh/vps_release_key
          sudo umount -R "${GITHUB_WORKSPACE}/work" 2>/dev/null || true
          sudo umount -R "${GITHUB_WORKSPACE}/output" 2>/dev/null || true
          sudo rm -rf "${GITHUB_WORKSPACE}/work"
          sudo rm -rf "${GITHUB_WORKSPACE}/output"
          sudo rm -rf "${GITHUB_WORKSPACE}/.tmp"
          sudo rm -rf /var/cache/pacman/pkg/*
          df -h